Availability of a Dependency Chain
An order-placement request flows through: CDN/edge (99.99%) → API gateway (99.99%) → order service (99.9%) → inventory service (99.9%) → primary database (99.95%) → a single third-party fraud-check API (99.0%). All calls are synchronous and every one must succeed for the order to be placed.
- Compute the end-to-end availability and the expected downtime per year.
- The team can either (a) add a second, independent fraud-check vendor with automatic failover, or (b) raise the order and inventory services from 99.9% to 99.99% each. Which option improves end-to-end availability more? Show the arithmetic.
- What assumption does your answer to (2) depend on, and how could it be violated in practice?
1. End-to-end availability (serial chain):
Multiply the availabilities:
A = 0.9999 × 0.9999 × 0.999 × 0.999 × 0.9995 × 0.99
Step by step: 0.9999 × 0.9999 = 0.99980; × 0.999 = 0.99880; × 0.999 = 0.99780; × 0.9995 = 0.99730; × 0.99 = 0.98733, i.e. about 98.73%. Unavailability ≈ 1.27% × 8,760 h ≈ 111 hours per year (roughly 4.6 days). The single 99% dependency dominates the loss.
2. Which improvement is bigger:
(a) Second independent fraud vendor in parallel:
A_fraud = 1 − (1 − 0.99)² = 1 − 0.0001 = 0.9999.
New chain: 0.99730 × 0.9999 ≈ 0.99720 → 99.72%, about 24.5 h/yr.
(b) Both internal services to 99.99%: chain becomes 0.9999 × 0.9999 × 0.9999 × 0.9999 × 0.9995 × 0.99 = 0.99960 × 0.9995 × 0.99 ≈ 0.99910 × 0.99 ≈ 0.98911 → 98.91%, about 95 h/yr.
Option (a) wins by a wide margin (99.72% vs 98.91%). Hardening already-good components barely moves the product; adding redundancy around the weakest serial link removes almost all of its contribution. This is the general rule: fix the weakest link first, and prefer parallel redundancy for dependencies you don't control.
3. The assumption — independence:
The parallel formula assumes the two vendors fail independently. In practice they may share an upstream (the same card network, the same cloud region, the same DNS provider), or your own failover logic may be the shared failure mode (a bug in the router that talks to both). Their joint availability is then far below 99.99%. Also, failover itself takes time — detection plus switch — which counts as downtime unless the breaker/health check flips within seconds. State the assumption in an interview and mention how you would validate it (chaos test the failover; review vendors' dependency lists).
Share this question